PT-2026-3410

Summary Since 2017, the default webpack plugins have passed the entire process.env to EnvironmentPlugin. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code or any dependency referenced process.env.VARIABLE NAME. This is not a regressio...

MAL-2025-190916 Malicious code in @tezign/html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 437929a07e5bc4e0e6dfe545fa858db027aa2ba4e6fa87701a09d5b07277b543 The package @tezign/html-webpack-plugin was found to contain malicious code...

EUVD-2025-198960

Malicious code in @tezign/html-webpack-plugin npm...

Malicious code in @tezign/html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 437929a07e5bc4e0e6dfe545fa858db027aa2ba4e6fa87701a09d5b07277b543 The package @tezign/html-webpack-plugin was found to contain malicious code...

EUVD-2025-178299

Malicious code in janus-robotics-optimize-css-assets-webpack-plugin-jovian npm...

EUVD-2025-180327

Malicious code in ariel-markdown-arcturus-terser-webpack-plugin npm...

EUVD-2025-176600

Malicious code in rollup-plugin-optimize-css-assets-webpack-plugin-bootes-polaris npm...

Malicious code in bunyan-redis-capella-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56b9ec0c5fa82205dee259b73ad694a1c72663bb5a0d4d0e23c5bbbfbe461f40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177573

Malicious code in node-config-phoenix-regulus-html-webpack-plugin npm...

EUVD-2025-177563

Malicious code in node-sass-luna-ora-terser-webpack-plugin npm...

EUVD-2025-178004

Malicious code in luna-local-optimize-css-assets-webpack-plugin-postgres npm...

EUVD-2025-175871

Malicious code in troposphere-comet-changelog-html-webpack-plugin npm...

EUVD-2025-175544

Malicious code in winston-html-webpack-plugin-hologram-meteor npm...

EUVD-2025-178852

Malicious code in fornax-janus-fusion-css-minimizer-webpack-plugin npm...

EUVD-2025-176413

Malicious code in server-filament-framework-css-minimizer-webpack-plugin npm...

EUVD-2025-177433

Malicious code in optimize-css-assets-webpack-plugin-pm2-lyra-miranda npm...

Malicious code in html-webpack-plugin-vega-atlas-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72fd14fbfa7df3518df196ac7331d4c07644a19e457f73f31be91ee9ab01ce42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179456

Malicious code in css-minimizer-webpack-plugin-vuetify-ichnology-redshift npm...

EUVD-2025-175972

Malicious code in tethys-acamar-protractor-html-webpack-plugin npm...

EUVD-2025-176604

Malicious code in rollup-plugin-html-webpack-plugin-cordelia-rollup npm...